Loading story…
Business email compromise (BEC) operators continued to defraud organizations through social engineering-heavy email campaigns that often avoided malware and attachments, instead impersonating executives, employees, and trusted business contacts to request wire transfers, gift cards, contract payments, and invoice changes. Researchers reported that attackers abused a wide range of email infrastructure, including free and local email services, encrypted providers, self-registered look-alike domains, and compromised accounts containing stolen email threads, while also hiding malicious routing through deceptive Reply-To addresses and spoofed display names.
The activity showed increasing sophistication across industries and regions, with some campaigns using acquisition-related pretexts, telecom-themed domains, multilingual lures, and COVID-19 or tax-related narratives to pressure victims into urgent financial action. Security firms said BEC remained one of the most financially damaging cybercrime threats, particularly in the Americas and Europe, and urged organizations to combine stronger email protections with employee awareness, careful review of sender details, and out-of-band verification for payment or account-change requests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
16 events from the most recent confirmed update back to the earliest known activity.
In August 2021, the operators of the fake cryptocurrency platform added a yearly fee of 0.0005 BTC that victims had to accept after changing their password and enabling MFA. Proofpoint described this as an evolution of the scam workflow.
Trend Micro reported a consistent increase in business email compromise activity during 2021, with a sudden increase in August. The company also noted campaigns spoofing ordinary employees' display names, not just executives'.
Proofpoint observed a later version of the cryptocurrency advance-fee fraud campaign starting in July 2021. This iteration used securecoins[.]net as the landing page while preserving the same fake-account withdrawal scheme.
Proofpoint observed the first wave of an advance-fee fraud campaign in May 2021 using the landing page coins45[.]com. The phishing emails provided credentials to fake Bitcoin accounts that appeared to hold large balances.
On 2021-03-30, the U.S. Internal Revenue Service issued a security alert about an ongoing email-based IRS impersonation campaign. The activity primarily targeted educational institutions and .edu users.
Proofpoint observed a smaller campaign in March 2021 targeting financial and accounting organizations in North America with fake tax preparation requests. The emails ultimately delivered NetWire RAT through a macro-enabled downloader.
In March 2021, Proofpoint observed an IRS-themed campaign using employee retention tax credit lures tied to COVID-19 impacts on employers. It sent more than 18,000 messages to over 2,000 entities and delivered TrickBot via XLSB Excel files.
Proofpoint said TA575 began a tax-themed campaign in early March 2021 that used American Rescue Plan-themed IRS lures. The emails linked to macro-enabled Excel documents that downloaded Dridex and affected more than 1,800 organizations.
Proofpoint reported that a campaign impersonating the UK's HM Revenue and Customs began in mid-February 2021. It abused Self-Employment Income Support Scheme themes and used fake authentication pages to steal credentials.
Proofpoint observed a 500% increase in tax-themed email campaigns delivering weaponized Excel 4.0 macros in the first three months of 2021. The company assessed attackers were using the technique because modern defenses had weaker detection coverage for it.
Trend Micro launched its 'BEC Display Name Spoofing' detection for Trend Micro Cloud App Security in the first quarter of 2021. The capability was introduced to detect impersonation that abuses sender display names.
Proofpoint noted that QBot had previously been distributed through XLSB files. This was cited as prior evidence of attackers using the format to reduce detection.
Talos described a support-contract-themed business email compromise campaign first seen in mid-2020. The emails requested transfers of several thousand Euros or British pounds and often claimed a treasurer was unavailable.
Talos said attackers increasingly incorporated COVID-19 themes into business email compromise emails beginning early in 2020. These lures claimed the sender was infected or invoked pandemic-related hardship to solicit gift card purchases.
Cisco Talos reported an acquisition-themed business email compromise campaign active since late 2019. It spoofed internal senders, used reply-to domains such as trustnet-gateway[.]cc and intranetgateway[.]net, and relied on phone-based social engineering.
Trend Micro observed the Gmail account cexecutive9<BLOCKED>@gmail.com sending business email compromise messages over multiple years. The same account also drew complaints on social media from scam targets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
agari.com
Open sourcetrendmicro.com
Open sourceproofpoint.com
Open sourceblog.talosintelligence.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported continued growth and diversification in **impersonation-driven phishing**. Guardio data cited by KnowBe4 identified **Microsoft** as the most impersonated brand in phishing during **Q4 2025**, followed by **Facebook, Roblox, McAfee, Steam, AT&T, Amazon, Google, Yahoo, and Coinbase**. The activity reportedly surged around high-traffic seasonal moments (e.g., Black Friday “storefront” scams, December delivery scams, and January job-search lures), reflecting attackers’ focus on exploiting predictable user behavior and time-sensitive themes. Separately, LevelBlue **SpiderLabs** reported **BEC** activity increased **15% in 2025 vs. 2024** based on *MailMarshal* telemetry, averaging **3,000+ BEC messages/month** (peaking at **4,300** in July). The report noted seasonal/operational timing effects (e.g., quarter transitions and summer vacation staffing gaps) and highlighted evolving tactics including **“contact details swapping,”** where attackers impersonate finance teams to “update” official contact information to redirect payments or communications. Together, the reporting indicates sustained growth in **impersonation and social engineering** as a primary driver of fraud and account compromise risk, with attackers adapting lures to business cycles and consumer seasons.
Jun 29, 2026
A wave of **phishing activity** is leveraging trusted brands and legitimate platform features to increase click-through and evade security controls. LinkedIn users are being targeted via fake “reply” comments posted on public threads that impersonate LinkedIn policy enforcement, claim an account violation, and push victims to external credential-harvesting pages. The lures mimic official branding and sometimes use LinkedIn’s own `lnkd.in` shortener to obscure destinations; reported redirect chains include Netlify-hosted pages (e.g., `very1929412.netlify[.]app`) leading to additional domains (e.g., `very128918[.]site`) designed to capture credentials. LinkedIn stated it is aware of the campaign and emphasized it does not communicate policy violations via public comments. Separately, RavenMail reported a large-scale email phishing campaign impacting **3,000+ organizations** (notably manufacturing) that abused **Google infrastructure** to bypass defenses: messages were sent via legitimate Google services, passed **SPF/DKIM/DMARC**, and used trusted Google-hosted URLs and Google Cloud Storage to host payloads and redirectors—without requiring a compromise of Google itself. In parallel trend reporting, LevelBlue SpiderLabs observed **BEC** volume rising **15% in 2025** based on MailMarshal telemetry (averaging 3,000 intercepted BEC messages per month), with evolving social engineering such as “**contact details swapping**,” where attackers impersonate finance teams to “update” official contact information to divert payments or data; this underscores continued attacker focus on impersonation and trust exploitation across both social platforms and email ecosystems.
Jun 29, 2026
Business Email Compromise (BEC) and Vendor Email Compromise (VEC) have emerged as significant threats to organizations, leveraging trusted relationships and sophisticated deception techniques to achieve financial and data theft. Attackers frequently gain unauthorized access to email accounts, often by compromising credentials or exploiting third-party vendors, and then use this access to monitor communications, create forwarding rules, and gather sensitive information. Once inside, adversaries may spend weeks or months surveilling email traffic, collecting intelligence on business processes, financial transactions, and supply chain relationships. This information is then weaponized to craft convincing fraudulent emails, such as fake invoices or requests to change bank account details, which are sent to employees or partners who are unlikely to question messages from familiar contacts. The use of AI-driven language models allows attackers to mimic the tone and style of legitimate correspondents, making detection by both humans and traditional secure email gateways (SEGs) challenging. Malicious content is often delivered via reputable file-sharing services, further reducing suspicion. Organizations that lack proper audit logging, such as Unified Audit Logging (UAL) in Microsoft Exchange environments, may be unable to determine which emails were accessed or what data was exfiltrated, hampering incident response and remediation efforts. Security teams are advised to ensure that audit logging is enabled and to regularly review configurations to support forensic investigations. Advanced detection tools, such as Darktrace / EMAIL, have demonstrated the ability to identify subtle anomalies in email behavior, flagging out-of-character messages even when they originate from trusted vendors. In one documented case, Darktrace detected four separate vendor compromise campaigns targeting a single customer within a two-week period, highlighting the prevalence and persistence of these attacks. The impact of BEC and VEC incidents can be severe, resulting in direct financial losses, reputational harm, and exposure of sensitive corporate data. Attackers may also use compromised information to launch further phishing campaigns or to infiltrate additional organizations within the supply chain. Effective defense requires a combination of technical controls, such as AI-powered anomaly detection, and procedural measures, including employee training and robust incident response planning. Organizations are encouraged to treat ongoing conversations with vendors and partners with appropriate scrutiny, especially when financial transactions or sensitive data are involved. Regular reviews of email security configurations and proactive monitoring for suspicious activity are essential to mitigate the risks posed by these evolving threats. The growing sophistication of BEC and VEC attacks underscores the need for continuous improvement in both technology and user awareness to protect organizational assets and relationships.
Jun 29, 2026